[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #240509 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Tuesday, April 7, 2026 5:59:23 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #240509 WARN: IUCC (AS378) - [Email_Analysis] [IUCC] [Customer]

Please find the analysis details for the Alert ID: 240509

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  14012100       46707         8.2%           18.161.97.64
  11966400       39888         7.0%           18.161.97.31
  11829600       39432         6.9%        142.251.127.132
  10671900       35573         6.2%           18.161.97.21
  10192200       33974         6.0%          18.161.97.115
   5679900       18933         3.3%           132.68.38.70
   3286500       10955         1.9%            104.18.9.52
   2626200        8754         1.5%         57.144.248.192
   2340300        7801         1.4%   2001:bf8:900:d:2::71
   2001900        6673         1.2%         57.144.244.192

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total            Dst IP
----------------------------------------------------
  46843800      156146        27.4%      132.68.38.70
  18845100       62817        11.0%    132.73.124.180
  11831400       39438         6.9%     132.66.42.110
   7533900       25113         4.4%   128.139.225.242
   3331200       11104         1.9%    132.67.245.101
   3284700       10949         1.9%    192.114.23.221
   3268200       10894         1.9%    192.114.91.243
   3079200       10264         1.8%     128.139.200.5
   2621100        8737         1.5%     132.74.74.134
   2514300        8381         1.5%     128.139.200.4

Top-10 Possible Targets by Bytes:
        Src IP   Src Port           Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                      443     132.68.38.70                69279680700
                              132.68.38.70                69279680700
                      443   132.73.124.180                27396134400
                            132.73.124.180                27396134400
  18.161.97.64        443                                 20724687300
  18.161.97.64                                            20724687300
  18.161.97.31        443                                 17695440600
  18.161.97.31                                            17695440600
                      443    132.66.42.110                15805688100
                             132.66.42.110                15805688100

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2026-04-07 14:59:10
End Time: ongoing

First Event Seen: 2026-04-07 14:56:00
Last Event Seen: 2026-04-07 14:57:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/240509/